Re: iptables performance under 2.6.0[-test9]

[Patrick McHardy <kaber@trash.net>]

Andy Polyakov wrote:

>As already mentioned in my last letter, note that 4th packet in
>fast.tcpdump is *not* actual wire traffic. On the wire [e.g. on server
>side] I see *two* packets with 1460 and 540 \n's as TCP payload.
>
>  
>
Sorry I forgot about this earlier, can you make the dumps again on
both sides of the firewall ? If possible sync the clocks of both
boxes so times are comparable.


>In either case it apparently has something[/everything?] to do with
>ip_refrag in ip_conntrack_standalone.c. At least if I comment out the
>"if ((*pskb)->len > dst_pmtu(&rt->u.dst)) { ... }" statement in this
>function, './head.pl some.host 2000' completes instantly even if I
>insmod the patched module. A.
>

Yes these lines are suspect nr. 1 ;) I wonder however how it keeps
working without refragmentation, this implies it's not necessary to
refragment here as the stack will do it anyways ..

Best regards,
Patrick